Creating an audit policy

When you create an audit policy, you have the option of creating its rules using a live server as a source to pick and choose for rules, by creating your own custom rules, or linking to the rules of another audit policy.

Using a source server for building audit policy rules allows you to base the audit policy’s rules on the actual configurations of a managed server. The source server used to build rules is not used after the audit policy is linked to an audit or snapshot specification.

All audit policies must be saved to a folder in the SA Client Library. Each audit policy name within a folder must be unique. To save an audit policy to a folder, you must have permissions to write to that folder. For more information about folder permissions, see the SA 10.51 Administer section.

To create an audit policy:

1. In the navigation pane, select Library > By Type > Audit and Remediation > Audit Policies.
2. Select an operating system: Windows, UNIX or VMware ESXi.
3. From the Actions menu, select New.
4. In the Properties content pane, enter a name and description. The name can contain underscores.
5. Click Select to specify a location in the SA Library where you want to save the audit policy.
6. In the Select Folder window, select a folder for the location. You must have permissions to write to the folder where you save the policy.
7. After you have chosen the location, click Select.

8. In the Audit Policy window, in the Views pane, select Source if you would like to use a managed server to base the audit policy’s rules on.

   Note This step does not apply to ESXi servers.

9. In the Source content pane, click Select to choose a source server for the audit policy.
10. In the Select Server window, select a server and then click OK.
11. In the Audit Policy window, in the Views pane, select Rules.
    1. If you want to link other audit policies to this audit, click to select an audit policy.
    2. If you want to edit any of the linked audit policies, from the Rules list, select an audit policy and then click to open the Audit Policy window.
12. In the Select an Audit Policy window, select one or more audit policies to link to the audit policy, and then click OK to save your selections.
    If you link one or more audit policies to an audit policy, you can still configure individual rules in the audit policy. All rules from an externally referenced audit policy will be combined with any rules you create to build one single rule set.
13. In the Views pane, in the Rules list, create any other rules you want to include in the audit policy. Audit and snapshot rules describes how to configure specific audit and remediation rules.
14. When you are finished configuring the audit, from the File menu select Save. After it is saved, the audit policy is ready to be linked to an audit, snapshot specification, or another audit policy.